v0.1.3

Breaking: stdin is now read only when there's no prompt argument, or when the arguments end with -. Pipe data like this: git diff | so ask -m review "Review this" -. A plain git diff | so ask "..." no longer attaches the diff.

This release hardens what panelists can see and what leaves your machine:

• Claude Code reads any file named in an @path mention in its prompt, whatever its tools allow. so now neutralises those mentions in everything it sends Claude, and passes Claude's deny rules as a private settings file.
• With repo access, Claude panelists are denied .git, agent-harness state (.recallstack, .specstory, aider history), so's own history and config, and backend homes (~/.claude, ~/.codex, ~/.pi/agent, or moved ones).
• --diff never attaches git-filtered (possibly decrypted) files, agent-harness state, so's own files or backend homes, even if they were deleted. Git filter drivers never run while it collects.
• Codex panelists no longer see your API keys or your installed skills, and no panelist loads a reviewed repository's AGENTS.md.
• A reviewed repository can no longer replace pi's system prompt, and pi runs with --offline.
• Markdown output puts every answer in a blockquote, so model text can't pose as a panel synthesis or panel key.
• so doctor warns about metered API keys, provider settings panelists drop, and Ollama providers that ignore pi's system prompt. If you use Kimi or GLM through pi, check this warning: without the fix it describes, those models never see so's instructions.
• so doctor --canary checks what each model can read, through its tools and through @ mentions, with and without repo access.
• Exit codes are now 1 when every panelist failed, 2 for a usage error, 3 inside a panelist, and 130 when interrupted.

Known gaps on Windows: npm-installed CLIs run through .cmd shims, which may mangle multi-line arguments, and Claude's absolute-path deny rules haven't been tested live there.